References instead of records
Send a stable case or member reference. A reviewer who needs the chart opens it in the system that already governs access to it.
HIPAA
Clinical AI agents in production, with the HIPAA evidence to show for it
Your privacy and security officers approve a prior authorization agent when they can see the rule each recommendation passed and who signed off, without wading through patient charts. VeriProof keeps those pieces together. Clinical detail stays out of the record when the decision didn't need it, and every clinical agent you add is held to the same standard.
Start with what stays out of the record
Your application decides which fields it sends. For most reviews, a case reference, the criteria version, and the policy result explain the decision. The clinical note can stay in the EHR.
Redaction you configure
Rules mask selected values in portal views and exports. Test them against the fields and formats your workflow actually uses.
Access by role
Each portal shows what that role's work needs. Auditors see the engagement in scope and nothing else.
One prior authorization request, recorded
The agent recommends
An AI agent recommends denying a request for an imaging study because the documented conservative treatment falls short of the plan's criteria.
The rule escalates
Your rule says a denial recommendation goes to a clinical reviewer. The reviewer gets the criteria version, the facts the agent used, and the choices available to them.
A person decides
The reviewer approves the study after reading a note the agent didn't weigh. Their decision goes back to the application, and reminders and escalation cover a reviewer who doesn't respond in time.
The outcome closes the case
The application reports what it did. The record now holds the recommendation, the rule, the reviewer's call, and the result, with no clinical note inside it.
Where the integrity proof lives
In the managed service, Azure SQL Database Ledger is the default integrity option. Reviewers check a record against the ledger to confirm it hasn't changed since it was written.
Private Enterprise, coming soon to Azure Marketplace
Private Enterprise will run entirely in your own Azure subscription, completely separate from veriproof.app. The platform, your records, and its integrity ledger (Azure SQL Database Ledger) all run there. Decision records and their proofs stay inside the environment your security team already governs.
A SaaS environment can use the Solana blockchain instead of Azure SQL Database Ledger, chosen when the environment is created. If yours does, only a fingerprint and transaction metadata are published. No patient data, and no personal data of any kind, is ever published to Solana.
Security Rule areas this evidence supports
Scroll horizontally to see all columns.
| Security Rule area | What VeriProof adds for connected AI agents |
|---|---|
| Audit controls, 45 CFR 164.312(b) | A decision record for each checked action: timestamps, rule version, reviewer, and reported outcome. |
| Integrity, 45 CFR 164.312(c)(1) | Proofs checked against Azure SQL Database Ledger, so changes to a record can be detected. |
| Access control, 45 CFR 164.312(a)(1) | Role portals, tenant separation, and a record of administrative activity. |
| Information system activity review, 45 CFR 164.308(a)(1)(ii)(D) | Exceptions, overrides, and denials from live decisions, which your team can review by agent and period. |
These areas sit inside a wider security program. The HHS Security Rule overview covers the rest.
HIPAA questions
BAA terms are agreed for your deployment during contracting, before any ePHI is sent. Our security review team walks through the data flow with you.
Only what your application sends. A case reference and policy result usually give the review enough context without the patient record.
No. If your environment uses Solana, it publishes only a fingerprint and transaction metadata. The decision content, and any patient data in it, stays out.